cftrace throws logged exception when Security Sandbox is enabled

[Aidan Whitehall]

When Security Sandbox is enabled, use of cftrace causes an exception to be logged to exception.log even though the sandbox grants Read & Write permissions the to {cf.instance.root}/logs/* directory whilst using jdk-11.0.24.

I'm assuming RollingFileManagerFactory needs some additional permission to roll cftrace.log over into cftrace.%i.log.

Does anyone know what additional sandbox permission needs to be granted to allow this? Thank you!

Error logged to {cf.instance.root}/logs/exception.log:

"Error","ajp-nio-127.0.0.1-8020-exec-10","10/21/24","12:44:08","{cf.application.name}","ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]"
java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]

[BKBK]

Hmm, I am surprised that you get the exception, given that the sandbox has granted Read & Write permissions to the directory {cf.instance.root}/logs/. Did you also enable Debugging in the ColdFusion Administrator? 

[Aidan Whitehall]

Yes, if by that you mean Enable Request Debugging Output.

By trial and error, it appears that two permission sets are required for this to work:

• {cf.instance.root}/logs/*   has    Read,Write
• {cf.instance.root}/logs/     has    Read,Write

I'd assumed that {cf.instance.root}/logs/* included files and the directory iteself, but perhaps not. Certainly without it, a read permission error is being written to exception.log.

With both permissions sets above, cftrace output appears in the page and is logged to cftrace.log when Security Sandbox is enabled.

It may be that Delete is required for the files to be rolled over into an archive, but am unsure on that as yet.

Thanks for your assistance, BKBK!

[Priyank Shrivastava.]

@Aidan Whitehall  Was it working before? Or this is the first time you are trying. I will run a quick test and let you know.

[Aidan Whitehall · Accepted solution]

Hi Priyank

Thanks for the offer of help. I'm trying to do some debugging, and am adding CFTRACE lines (there were none previously) so it can be left in production code.

As mentioned in the reply to BKBK, it's now working after adding two permission sets. Without both, some form of exception is logged or cftrace.log isn't written to. I'd assumed /logs/* included the directory itself, but perhaps not.

Regards

Aidan

[BKBK]

Hi Aidan,

Thanks for the update and for sharing your experience. Your discovery of this cftrace quirk will certainly help fellow developers.

Regards,

BKBK